CVE-2026-103331: UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret

Q: Who is exposed to this issue?

Sites using the UniPAY Payment Gateway For WooCommerce plugin through version 2.3 are exposed when the merchant secret used to validate payment notifications remains empty, which is the default configuration.

Q: What does an attacker need to exploit it?

An attacker does not need authentication. They can forge a payment notification that passes the plugin's signature validation because the default merchant secret is empty, and use it to mark arbitrary orders as paid.

Q: How can I tell whether my site is affected?

Check whether the UniPAY Payment Gateway For WooCommerce plugin is version 2.3 or earlier and whether its merchant secret for payment-notification validation is unset or empty.

Q: What can be done if patching is not immediately possible?

Set a non-empty merchant secret for payment-notification validation. This prevents signatures from being validated against the empty default secret described in the vulnerability.

Published Oct 28, 2026

Updated

The UniPAY Payment Gateway For WooCommerce WordPress plugin through 2.3 does not properly verify the authenticity of payment notifications, as their signature is checked against a merchant secret that is empty by default, allowing unauthenticated attackers to forge a valid notification and mark arbitrary orders as paid.

Affected Software

1 affected component

UniPAY UniPAY Payment Gateway For WooCommerce<=2.3

Event History

Oct 28, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using the UniPAY Payment Gateway For WooCommerce plugin through version 2.3 are exposed when the merchant secret used to validate payment notifications remains empty, which is the default configuration.

What does an attacker need to exploit it?

An attacker does not need authentication. They can forge a payment notification that passes the plugin's signature validation because the default merchant secret is empty, and use it to mark arbitrary orders as paid.

How can I tell whether my site is affected?

Check whether the UniPAY Payment Gateway For WooCommerce plugin is version 2.3 or earlier and whether its merchant secret for payment-notification validation is unset or empty.

What can be done if patching is not immediately possible?

Set a non-empty merchant secret for payment-notification validation. This prevents signatures from being validated against the empty default secret described in the vulnerability.

CVE-2026-103331: UniPAY Payment Gateway For WooCommerce <= 2.3 - Unauthenticated Order Payment Forgery via Empty IPN Secret

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether my site is affected?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

How can I tell whether my site is affected?

What can be done if patching is not immediately possible?